nerdexam
Microsoft

AZ-305 · Question #87

Drag and Drop Question You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux. You need to use Azure Log Analytics design an alerting…

The correct answer is Event; Syslog. The 'Event' table in Log Analytics stores Windows Event Log data collected from Windows Server machines, making it the correct table to query for security-related events on Windows Server 2016 (e.g., Security event logs). The 'Syslog' table stores log data collected from Linux…

Submitted by lars.no· Mar 6, 2026Monitor and maintain security posture using Azure Monitor and Log Analytics - typically mapped to the 'Manage security operations' or 'Configure security monitoring' domain in AZ-500 (Azure Security Engineer Associate) certification.

Question

Drag and Drop Question You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux. You need to use Azure Log Analytics design an alerting strategy for security-related events. Which Log Analytics tables should you query? To answer, drag the appropriate tables to the correct log types. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-305 question #87 exhibit

Answer Area

Drag items

AzureActivityAzureDiagnosticsEventSyslog

Correct arrangement

  • Event
  • Syslog

Explanation

The 'Event' table in Log Analytics stores Windows Event Log data collected from Windows Server machines, making it the correct table to query for security-related events on Windows Server 2016 (e.g., Security event logs). The 'Syslog' table stores log data collected from Linux machines via the Syslog daemon, making it the appropriate table for security-related events on Linux systems. Together, these two tables cover the Windows and Linux virtual machines described in the scenario.

Topics

#Azure Log Analytics#Security Monitoring#Windows Event Logs#Syslog

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-305 Practice